Professional-Cloud-Network-Engineer Practice Exams and Training Solutions for Certifications
Dumps Free Test Engine Player Verified Answers
The Google Professional-Cloud-Network-Engineer certification exam is a rigorous assessment of a candidate’s skills and knowledge of network engineering on the Google Cloud Platform. The exam consists of multiple-choice and scenario-based questions that require candidates to apply their skills and knowledge to real-world situations. To pass the exam, candidates must score at least 70% on the exam.
NEW QUESTION # 28
You are creating an instance group and need to create a new health check for HTTP(s) load balancing.
Which two methods can you use to accomplish this? (Choose two.)
- A. Create a new legacy health check using the gcloud command line tool.
- B. Create a new health check, or select an existing one, when you complete the load balancer's backend configuration in the GCP Console.
- C. Create a new health check using the gcloud command line tool.
- D. Create a new health check using the VPC Network section in the GCP Console.
- E. Create a new legacy health check using the Health checks section in the GCP Console.
Answer: B,C
Explanation:
https://cloud.google.com/load-balancing/docs/health-checks#creating_and_modifying_health_checks
NEW QUESTION # 29
Your company has just launched a new critical revenue-generating web application. You deployed the application for scalability using managed instance groups, autoscaling, and a network load balancer as frontend. One day, you notice severe bursty traffic that the caused autoscaling to reach the maximum number of instances, and users of your application cannot complete transactions. After an investigation, you think it as a DDOS attack. You want to quickly restore user access to your application and allow successful transactions while minimizing cost.
Which two steps should you take? (Choose two.)
- A. SSH into the backend compute engine instances, and view the auth logs and syslogs to further understand the nature of the attack.
- B. Shut down the entire application in GCP for a few hours. The attack will stop when the application is offline.
- C. Use Cloud Armor to blacklist the attacker's IP addresses.
- D. Increase the maximum autoscaling backend to accommodate the severe bursty traffic.
- E. Create a global HTTP(s) load balancer and move your application backend to this load balancer.
Answer: A,D
NEW QUESTION # 30
You have enabled HTTP(S) load balancing for your application, and your application developers have reported that HTTP(S) requests are not being distributed correctly to your Compute Engine Virtual Machine instances. You want to find data about how the request are being distributed.
Which two methods can accomplish this? (Choose two.)
- A. In Stackdriver Monitoring, select Resources > Metrics Explorer and search for https/request_bytes_count metric.
- B. On the Load Balancer details page of the GCP Console, click on the Monitoring tab, select your backend service, and look at the graphs.
- C. In Stackdriver Error Reporting, look for any unacknowledged errors for the Cloud Load Balancers service.
- D. In Stackdriver Monitoring, create a new dashboard and track the https/backend_request_count metric for the load balancer.
- E. In Stackdriver Monitoring, select Resources > Google Cloud Load Balancers and review the Key Metrics graphs in the dashboard.
Answer: B,D
NEW QUESTION # 31
Your organization requires that metrics from all applications be retained for 5 years for future analysis in possible legal proceedings. Which approach should you use?
- A. Grant the security team access to the logs in each Project.
- B. Configure Stackdriver Monitoring for all Projects, and export to BigQuery.
- C. Configure Stackdriver Monitoring for all Projects with the default retention policies.
- D. Configure Stackdriver Monitoring for all Projects, and export to Google Cloud Storage.
Answer: D
Explanation:
B and D can be quickly ruled out because none of them is good solution for the requirements
"retained for 5 years"
Between A and C, the different is where to store, BigQuery or Cloud Storage. Since the main concern is extended storing period, C (Correct Answer) is better answer, and the "retained for 5 years for future analysis" further qualifies it, for example, using Coldline storage class.
With regards of BigQuery, while it is also a low-cost storage, but the main purpose is for analysis.
Also, logs in Cloud Storage is easy to transport to BigQuery whenever needed.
NEW QUESTION # 32
Your company is working with a partner to provide a solution for a customer. Both your company and the partner organization are using GCP. There are applications in the partner's network that need access to some resources in your company's VPC. There is no CIDR overlap between the VPCs.
Which two solutions can you implement to achieve the desired results without compromising the security? (Choose two.)
- A. Shared VPC
- B. Cloud NAT
- C. Dedicated Interconnect
- D. Cloud VPN
- E. VPC peering
Answer: C,D
Explanation:
https://cloud.google.com/vpc/docs/vpc
NEW QUESTION # 33
Your company has recently expanded their EMEA-based operations into APAC. Globally distributed users report that their SMTP and IMAP services are slow. Your company requires end-to-end encryption, but you do not have access to the SSL certificates.
Which Google Cloud load balancer should you use?
- A. TCP proxy load balancer
- B. SSL proxy load balancer
- C. Network load balancer
- D. HTTPS load balancer
Answer: B
NEW QUESTION # 34
You are configuring your Google Cloud environment to connect to your on-premises network. Your configuration must be able to reach Cloud Storage APIs and your Google Kubernetes Engine nodes across your private Cloud Interconnect network. You have already configured a Cloud Router with your Interconnect VLAN attachments. You now need to set up the appropriate router advertisement configuration on the Cloud Router. What should you do?
- A. Configure the route advertisement to the custom setting, and manually add prefix 199.36.153.8/30 to the list of advertisements. Leave all other options as their default settings.
- B. Configure the route advertisement to the default setting.
- C. On the on-premises router, configure a static route for the storage API virtual IP address which points to the Cloud Router's link-local IP address.
- D. Configure the route advertisement to the custom setting, and manually add prefix 199.36.153.8/30 to the list of advertisements. Advertise all visible subnets to the Cloud Router.
Answer: A
NEW QUESTION # 35
You work for a organization called cloudtech5 . Your organization has decided to implement continuous integration and delivery (CI/CD) pipeline on Google Cloud Platform using only hosted products and the popular GitOps methodology . The architecture includes many microservices that are updated frequently and rolled back . Please select the products that should be used.
- A. Cloud Storage , Cloud Dataflow,Compute Engine.
- B. Cloud Source repositories, Cloud Build ,Container Registry,Google Kubernetes Engine
- C. Cloud Source repositories, Jenkins on Compute Engine , Container Registry , Google Kubernetes Engine.
- D. BitBucket , Cloud Build , Container Registry , Google Kubernetes Engine.
Answer: B
Explanation:
Option A is the Correct choice because , Cloud Source repositories is a a fully featured, scalable, private Git repository hosted on Google Cloud . Cloud Build is a service that executes your builds on Google Cloud Platform infrastructure. Cloud Build can import source code from Google Cloud Storage, Cloud Source Repositories, GitHub, or Bitbucket, execute a build to your specifications, and produce artifacts such as Docker containers or Java archives. Container Registry is a private container image registry that runs on Google Cloud Platform. Google Kuberenetes Engine is ideal for deploying small services that can be updated and rolled back quickly.
Option B is Incorrect because , BitBucket isn't Google Cloud hosted service but it can be used to achieve the same results .
Option C is Incorrect because Jenkins on Compute Engine isn't Google hosted product , Cloud build is the right choice because it is a service managed by Google Cloud .
Option D is Incorrect because , the objective is to implement CI/CD pipeline not data processing pipeline .
NEW QUESTION # 36
You need to restrict access to your Google Cloud load-balanced application so that only specific IP addresses can connect.
What should you do?
- A. Create a secure perimeter using VPC Service Controls, and mark the load balancer as a service restricted to the source IP range of the allowed clients and Google health check IP ranges.
- B. Tag the backend instances "application," and create a firewall rule with target tag "application" and the source IP range of the allowed clients and Google health check IP ranges.
- C. Create a secure perimeter using the Access Context Manager feature of VPC Service Controls and restrict access to the source IP range of the allowed clients and Google health check IP ranges.
- D. Label the backend instances "application," and create a firewall rule with the target label "application" and the source IP range of the allowed clients and Google health check IP ranges.
Answer: B
Explanation:
https://cloud.google.com/load-balancing/docs/https/setting-up-https#sendtraffic
NEW QUESTION # 37
You are trying to update firewall rules in a shared VPC for which you have been assigned only Network Admin permissions. You cannot modify the firewall rules. Your organization requires using the least privilege necessary.
Which level of permissions should you request?
- A. Security Admin privileges from the Shared VPC Admin.
- B. Shared VPC Admin privileges from the Organization Admin.
- C. Organization Admin privileges from the Organization Admin.
- D. Service Project Admin privileges from the Shared VPC Admin.
Answer: A
Explanation:
A Shared VPC Admin can define a Security Admin by granting an IAM member the Security Admin (compute.securityAdmin) role to the host project. Security Admins manage firewall rules and SSL certificates.
NEW QUESTION # 38
You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)
- A. Create network peering between your VPC and BigQuery.
- B. Enable Private Services Access on the VPC.
- C. Enable Private Google Access on the VPC.
- D. Create a Cloud NAT, and route the application traffic via NAT gateway.
- E. Enable Private Google Access on all the subnets.
Answer: D,E
Explanation:
https://cloud.google.com/nat/docs/overview#interaction-pga Specifications https://cloud.google.com/vpc/docs/configure-private-google-access#specifications
NEW QUESTION # 39
You are designing a hybrid cloud environment for your organization. Your Google Cloud environment is interconnected with your on-premises network using Cloud HA VPN and Cloud Router. The Cloud Router is configured with the default settings. Your on-premises DNS server is located at 192.168.20.88 and is protected by a firewall, and your Compute Engine resources are located at 10.204.0.0/24. Your Compute Engine resources need to resolve on-premises private hostnames using the domain corp.altostrat.com while still resolving Google Cloud hostnames. You want to follow Google-recommended practices. What should you do?
- A. Create a private forwarding zone in Cloud DNS for 'corp .altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
Modify the /etc/resolv conf file on your Compute Engine instances to point to 192.168.20 88 - B. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168 20.88.
Configure your on-premises firewall to accept traffic from 35.199.192.0/19 Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. - C. Create a private forwarding zone in Cloud DNS for 'corp.altostrat.com' called corp-altostrat-com that points to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 10.204.0.0/24.
Set a custom route advertisement on the Cloud Router for 10.204.0.0/24 - D. Create a private zone in Cloud DNS for 'corp altostrat.com' called corp-altostrat-com.
Configure DNS Server Policies and create a policy with Alternate DNS servers to 192.168.20.88.
Configure your on-premises firewall to accept traffic from 35.199.192.0/19.
Answer: D
Explanation:
Set a custom route advertisement on the Cloud Router for 35.199.192.0/19.
NEW QUESTION # 40
You have deployed an HTTP(s) load balancer, but health checks to port 80 on the Compute Engine virtual machine instance are failing, and no traffic is sent to your instances. You want to resolve the problem. Which commands should you run?
- A. gcloud compute instances add-access-config instance-1
- B. gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --source-ranges 130.211.0.0/22,35.191.0.0/16 --direction INGRESS
- C. gcloud compute health-checks update http health-check --unhealthy-threshold 10
- D. gcloud compute firewall-rules create allow-lb --network load-balancer --allow tcp --destination-ranges 130.211.0.0/22,35.191.0.0/16 --direction EGRESS
Answer: A
NEW QUESTION # 41
You are designing a new global application using Compute Engine instances that will be exposed by a global HTTP(S) load balancer. You need to secure your application from distributed denial-of-service and application layer (layer 7) attacks. What should you do?
- A. Configure a Google Cloud Armor security policy in your project, and attach it to the backend service to secure the application.
- B. Configure VPC Service Controls and create a secure perimeter. Define fine-grained perimeter controls and enforce that security posture across your Google Cloud services and projects.
- C. Configure hierarchical firewall rules for the global HTTP(S) load balancer public IP address at the organization level.
- D. Configure VPC firewall rules to protect the Compute Engine instances against distributed denial-of-service attacks.
Answer: D
NEW QUESTION # 42
Your organization's security policy requires that all internet-bound traffic return to your on-premises data center through HA VPN tunnels before egressing to the internet, while allowing virtual machines (VMs) to leverage private Google APIs using private virtual IP addresses 199.36.153.4/30. You need to configure the routes to enable these traffic flows. What should you do?
- A. Configure a custom route 0.0.0.0/0 with a priority of 1000 whose next hop is the internet gateway. Configure another custom route 199.36.153.4/30 with a priority of 500 whose next hop is the VPN tunnel back to the on-premises data center.
- B. Configure a custom route 0.0.0.0/0 with a priority of 500 whose next hop is the default internet gateway. Configure another custom route 199.36.153.4/30 with priority of 1000 whose next hop is the VPN tunnel back to the on-premises data center.
- C. Announce a 0.0.0.0/0 route from your on-premises router with a MED of 1000. Configure a custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the default internet gateway.
- D. Announce a 0.0.0.0/0 route from your on-premises router with a MED of 500. Configure another custom route 199.36.153.4/30 with a priority of 1000 whose next hop is the VPN tunnel back to the on-
Answer: B
Explanation:
premises data center.
NEW QUESTION # 43
......
Q&As with Explanations Verified & Correct Answers: https://www.actual4cert.com/Professional-Cloud-Network-Engineer-real-questions.html
Professional-Cloud-Network-Engineer Dumps with Free 365 Days Update Fast Exam Updates: https://drive.google.com/open?id=1FRYRwwJV2RJgcq0XRrD2cbsMitDnfyZL